CVE-2025-14146: Booking Calendar Information Disclosure

CVE-2025-14146 Overview

The Booking Calendar plugin for WordPress contains a sensitive information exposure vulnerability affecting all versions up to and including 10.14.10. The flaw resides in the WPBC_FLEXTIMELINE_NAV AJAX action, where nonce verification is conditionally disabled by default. The booking_is_nonce_at_front_end option ships as 'Off', removing the primary authorization control on this endpoint. When administrators enable booking_is_show_popover_in_timeline_front_end, or when the plugin runs in a demo configuration where this option is enabled by default, unauthenticated attackers can query the endpoint. Attackers retrieve customer names, email addresses, phone numbers, and full booking details from the site. The issue is classified under [CWE-862] Missing Authorization.

Critical Impact
Unauthenticated remote attackers can exfiltrate personally identifiable information (PII) from WordPress sites running vulnerable Booking Calendar configurations without any user interaction.

Affected Products

WordPress Booking Calendar plugin — all versions through 10.14.10
Sites with booking_is_nonce_at_front_end set to 'Off' (default)
Installations with booking_is_show_popover_in_timeline_front_end enabled, including demo deployments

Discovery Timeline

2026-01-09 - CVE-2025-14146 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14146

Vulnerability Analysis

The Booking Calendar plugin registers the WPBC_FLEXTIMELINE_NAV AJAX action in core/lib/wpbc-ajax.php to power its front-end timeline navigation. The handler returns booking records so the timeline can render popovers showing reservation details. The AJAX endpoint is accessible via admin-ajax.php to both authenticated and unauthenticated visitors. Authorization relies on a WordPress nonce, but the nonce check is wrapped in a runtime option lookup rather than being enforced unconditionally. Because the plugin ships with the nonce option disabled by default, the endpoint is effectively open. When the timeline popover feature is active, the handler emits full booking data — including customer names, email addresses, phone numbers, and reservation contents — directly in the JSON response.

Root Cause

The root cause is a Missing Authorization defect [CWE-862] introduced by option-gated nonce verification in includes/_functions/nonce_func.php. Instead of always validating the nonce, the plugin consults the booking_is_nonce_at_front_end setting, which is initialized to 'Off' in core/wpbc-activation.php. Sensitive booking data is returned without a secondary authorization or capability check.

Attack Vector

An unauthenticated attacker sends a crafted POST request to admin-ajax.php with action=WPBC_FLEXTIMELINE_NAV and timeline parameters. The vulnerable timeline handler in core/timeline/v2/wpbc-class-timeline_v2.php skips nonce validation, executes the query, and returns booking records in the response body. Refer to the Wordfence Vulnerability Report and the WordPress Booking Plugin Changeset for the corrective patch and code paths.

Detection Methods for CVE-2025-14146

Indicators of Compromise

Repeated POST requests to /wp-admin/admin-ajax.php containing action=WPBC_FLEXTIMELINE_NAV from unauthenticated sessions
Anomalous outbound response sizes from admin-ajax.php correlated with the timeline action
Requests to the timeline endpoint from clients that never load the site's public booking page
Sequential enumeration patterns iterating through timeline date ranges

Detection Strategies

Alert on high request volumes to admin-ajax.php with WPBC_FLEXTIMELINE_NAV in the POST body
Compare Booking Calendar plugin version against 10.14.10 or earlier across all managed WordPress hosts
Audit the booking_is_nonce_at_front_end and booking_is_show_popover_in_timeline_front_end option values in wp_options

Monitoring Recommendations

Ingest WordPress access logs into a centralized log store and flag calls to the vulnerable AJAX action
Track HTTP response byte counts on the AJAX endpoint to detect bulk data extraction
Monitor for scanners fingerprinting the booking plugin path at /wp-content/plugins/booking/

How to Mitigate CVE-2025-14146

Immediate Actions Required

Update the Booking Calendar plugin to the version released in the referenced WordPress Booking Plugin Changeset
Set booking_is_nonce_at_front_end to 'On' in the plugin settings until patching is complete
Disable booking_is_show_popover_in_timeline_front_end on production and demo sites
Review web server logs for prior exploitation attempts targeting WPBC_FLEXTIMELINE_NAV

Patch Information

The vendor addressed the flaw by enforcing nonce verification on the WPBC_FLEXTIMELINE_NAV handler and removing option-based bypass logic. Administrators should upgrade to the fixed release published after version 10.14.10. See the Wordfence Vulnerability Report for confirmed fixed versions.

Workarounds

Toggle the front-end nonce option to 'On' from the Booking Calendar settings to force nonce validation
Disable the timeline popover feature to prevent the vulnerable code path from returning booking data
Restrict access to admin-ajax.php calls containing WPBC_FLEXTIMELINE_NAV at the WAF layer
Remove or deactivate the plugin on demo installations that do not require booking functionality

bash

# WAF rule example: block unauthenticated access to the vulnerable AJAX action
# ModSecurity-style rule
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1014146,msg:'Block CVE-2025-14146 exploitation attempt'"
SecRule REQUEST_BODY "@contains action=WPBC_FLEXTIMELINE_NAV" \
  "chain"
SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"